To my knowledge, there isn't a single publisher or ad network that take full legal responsibility if they distribute malware, false goods, or have other form of illegal ads. If there is one, let me know and I will take a look.
Got burnt by some ransomware, now what? Use that backup you hopefully have and that's it. In the time between backup and damage, the primary browser would have touched just about every ad network in existence and nobody knows how many other unpublished holes might have been responsible for the malware to leak in.
Art the other end of the range, if you are a security expert analyzing the incoming flood, you may have an abstract case of attempted computer fraud, but no concrete damages.
Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)
That's a good point. Maybe ad-blockers will impose accountability.
Edit: There's a tendency to be irresponsible when effectively anonymous. But there's still risk. Let's say that some ad network is hosting ransomware. Well over 99% of victims will have no provable damages. But maybe you take out some business and all of the day's backups. There's also the potential for class tort.
Each personal computer and laptop should be in the range of a $200. A work desktop or server should be in the range of $2000-5000, since then you got to verify the integrity of data and secrecy of costumers. Since a maladvertisement attack hits tens of thousands of users, a class action suit could be in any range, and it would be hard to guess the end result.